Question

我对下面凌乱的HTML语法表示歉意。当我启用http.authorizeRequest() csrf时，我不断收到403错误。当然，如果我有csrf.disable()，一切正常。

据我了解，<form:form>标记自动使用了CSRF令牌，因为下面的URL停止工作，所以必须如此。

有人能告诉我我不明白的是什么吗？

NetworkError：403禁止 - http://localhost:8080/AssetCore/createGuideline/

我的配置类：

@SuppressWarnings("deprecation")
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter{
    private final Logger log = Logger.getLogger (this.getClass());
    /**
     * This class gets called during startup.
     */

    /**
     * Configure http security.
     */
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        /**
         * This method gets called when the app starts up.
         * I believe that all the patterns for the MVC and rest calls will need to go here.
         */
        log.info("configure(): called to set up authorizedRequest pattern matching.");
        http
            .logout().logoutSuccessUrl("/login?loggedout=true").invalidateHttpSession(true).deleteCookies("JSESSIONID")
            .logoutRequestMatcher(new AntPathRequestMatcher("/logout"));
        http.authorizeRequests()
            .antMatchers(HttpMethod.PUT, "/assessment/**").permitAll()
            .antMatchers("/createGuideline/**",).permitAll()    
    }

JSP：

   <%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
<%@ taglib uri="http://www.springframework.org/tags/form" prefix="form"%>
<%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags"%>
<%@ taglib prefix="ark" tagdir="/WEB-INF/tags" %>
<!DOCTYPE html>
<html lang="en">
    <head>
        <meta http-equiv="content-type"
            content="text/html; charset=windows-1252">
        <meta charset="utf-8">
        <title>ASSET Core - PCC</title>
        <jsp:include page="ourCSSandJS.jsp" />
        <link rel="stylesheet" href="/AssetCore/resources/css/pccStyle.css">
        <link rel="stylesheet" href="/AssetCore/resources/css/scrollbar.css">
        <link rel="stylesheet" href="/AssetCore/resources/css/mcp_style.css">
        <script>var storedFormatExtraArgs = [];</script>
        <script src="/AssetCore/resources/js/valid/pcc.js"></script>
        <script src="/AssetCore/resources/js/controlFormatting.js"></script>
        <script src="/AssetCore/resources/js/valid/controlCard.js"></script>
        <script src="/AssetCore/resources/js/thirdParty/jquery.scrollbar.min.js"></script>
        <script type="text/javascript" src="https://www.gstatic.com/charts/loader.js"></script>     
    </head>
    <body>`                     <form:form id="customGuide" method="POST"
                            action="/AssetCore/createGuideline">
                            <fieldset>
                                <legend id="createGuideline">Create Guideline</legend>
                                <p>
                                    <label for="gName">Name</label><br /> <input type="text"
                                        id="gName" name="gName" />
                                </p>`

Answer 1

好的，所以Spring文档是不正确的，至少不是我看到的。我实际上将以下内容添加到In [1]: import matplotlib In [2]: matplotlib.use('Agg') In [3]: import matplotlib.pyplot as plt In [4]: fig, ax = plt.subplots(1, 1) In [5]: import numpy as np In [6]: x = np.linspace(-1., 1.) In [7]: y = np.sin(x) In [8]: ax.plot(x, y) Out[8]: [<matplotlib.lines.Line2D at 0x1057ecf10>] In [9=]: fig.savefig('myplot.png')代码

中

<form:form>

现在它有效。

为什么Spring csrf会给我403网络错误？

1 个答案: